vendor/pimcore/portal-engine/src/Controller/AuthController.php line 41

  1. <?php
  3. /**
  4. * This source file is available under the terms of the
  5. * Pimcore Open Core License (POCL)
  6. * Full copyright and license information is available in
  7. * LICENSE.md which is distributed with this source code.
  8. *
  9. * @copyright Copyright (c) Pimcore GmbH (https://www.pimcore.com)
  10. * @license Pimcore Open Core License (POCL)
  11. */
  13. namespace Pimcore\Bundle\PortalEngineBundle\Controller;
  15. use Exception;
  16. use GuzzleHttp\ClientInterface;
  17. use InvalidArgumentException;
  18. use Pimcore\Bundle\OpenIdConnectBundle\Client\Provider\OpenIdConnectProvider;
  19. use Pimcore\Bundle\OpenIdConnectBundle\EventListener\OpenIdSessionBagListener;
  20. use Pimcore\Bundle\PortalEngineBundle\Exception\OutputErrorException;
  21. use Pimcore\Bundle\PortalEngineBundle\Form\LoginForm;
  22. use Pimcore\Bundle\PortalEngineBundle\Form\RecoverPasswordForm;
  23. use Pimcore\Bundle\PortalEngineBundle\Model\View\Notification;
  24. use Pimcore\Bundle\PortalEngineBundle\Service\Content\HeadTitleService;
  25. use Pimcore\Bundle\PortalEngineBundle\Service\Frontend\FrontendNotificationService;
  26. use Pimcore\Bundle\PortalEngineBundle\Service\Frontend\FrontendVariantService;
  27. use Pimcore\Bundle\PortalEngineBundle\Service\PortalConfig\PortalConfigService;
  28. use Pimcore\Bundle\PortalEngineBundle\Service\Security\Authentication\User\PasswordChangeableService;
  29. use Pimcore\Bundle\PortalEngineBundle\Service\Security\Authentication\User\RecoverPasswordService;
  30. use Pimcore\Bundle\PortalEngineBundle\Service\Security\Authenticator\OpenIdConnectAuthenticator;
  31. use Pimcore\Tool;
  32. use Pimcore\Tool\Session;
  33. use Symfony\Component\Form\FormFactoryInterface;
  34. use Symfony\Component\Form\FormInterface;
  35. use Symfony\Component\HttpFoundation\RedirectResponse;
  36. use Symfony\Component\HttpFoundation\Request;
  37. use Symfony\Component\HttpFoundation\Response;
  38. use Symfony\Component\HttpFoundation\Session\Attribute\AttributeBag;
  39. use Symfony\Component\HttpFoundation\Session\Attribute\AttributeBagInterface;
  40. use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
  41. use Symfony\Component\Routing\Attribute\Route;
  42. use Symfony\Contracts\Translation\LocaleAwareInterface;
  43. use Symfony\Contracts\Translation\TranslatorInterface;
  45. /**
  46. * @internal
  47. */
  48. #[Route(path: '/auth', condition: "request.attributes.get('isPortalEngineSite')")]
  49. class AuthController extends AbstractSiteController
  50. {
  51. public function __construct(protected ClientInterface $httpClient)
  52. {
  53. }
  55. /**
  56. * @return Response
  57. */
  58. #[Route(path: '/login', name: 'pimcore_portalengine_auth_login')]
  59. public function loginAction(Request $request, FormFactoryInterface $formFactory, HeadTitleService $headTitleService, TranslatorInterface $translator, PortalConfigService $portalConfigService, PasswordChangeableService $passwordChangeableService, FrontendVariantService $frontendVariantService)
  60. {
  61. /** @var string $locale */
  62. $locale = $request->getPreferredLanguage(Tool::getValidLanguages());
  63. if ($translator instanceof LocaleAwareInterface) {
  64. $translator->setLocale($locale);
  65. }
  66. $request->setLocale($locale);
  68. $portalName = $portalConfigService->getPortalName();
  69. $oidcProviders = $portalConfigService->getCurrentPortalConfig()->getOidcConfigs();
  70. $guestUserActivated = !empty($portalConfigService->getCurrentPortalConfig()->getGuestUser());
  71. $headTitleService->setTitle($translator->trans('portal-engine.content.title.auth-login', ['%name%' => $portalName], 'portal_engine_frontend'));
  73. $loginForm = $formFactory->create(LoginForm::class);
  75. // The new studio login is served only to portals on the new frontend; legacy portals keep
  76. // their original Bootstrap login (auth/login.html.twig).
  77. $template = $frontendVariantService->isNew()
  78. ? '@PimcorePortalEngine/auth/login-studio.html.twig'
  79. : '@PimcorePortalEngine/auth/login.html.twig';
  81. return $this->renderTemplate($template, [
  82. 'form' => $loginForm->createView(),
  83. 'loginFailed' => (bool)$request->query->get('loginFailed'),
  84. 'portalName' => $portalName,
  85. 'oidcProviderNames' => array_keys($oidcProviders),
  86. 'guestUserActivated' => $guestUserActivated,
  87. 'showRecoverPassword' => $passwordChangeableService->isPasswordChangeable()
  88. ]);
  89. }
  91. /**
  92. * @return RedirectResponse
  93. */
  94. #[Route(path: '/logout', name: 'pimcore_portalengine_auth_logout')]
  95. public function logoutAction(Request $request)
  96. {
  97. return $this->redirectToRoute('pimcore_portalengine_auth_login');
  98. }
  100. /**
  101. * @return Response
  102. */
  103. #[Route(path: '/recover-password', name: 'pimcore_portalengine_auth_recover_password')]
  104. public function recoverPasswordAction(Request $request, TranslatorInterface $translator, FormFactoryInterface $formFactory, FrontendNotificationService $frontendNotificationService, RecoverPasswordService $recoverPasswordService, PasswordChangeableService $passwordChangeableService, HeadTitleService $headTitleService, FrontendVariantService $frontendVariantService): Response
  105. {
  106. if (!$passwordChangeableService->isPasswordChangeable()) {
  107. throw new NotFoundHttpException('password not changeable');
  108. }
  110. /** @var string $locale */
  111. $locale = $request->getPreferredLanguage(Tool::getValidLanguages());
  112. if ($translator instanceof LocaleAwareInterface) {
  113. $translator->setLocale($locale);
  114. }
  115. $request->setLocale($locale);
  117. $headTitleService->setTitle($translator->trans('portal-engine.content.title.auth-recover-password', [], 'portal_engine_frontend'));
  119. /** @var FormInterface $recoverPasswordForm */
  120. $recoverPasswordForm = $formFactory
  121. ->create(RecoverPasswordForm::class)
  122. ->handleRequest($request);
  124. if ($request->isMethod(Request::METHOD_POST) && $recoverPasswordForm->isSubmitted() && $recoverPasswordForm->isValid()) {
  125. try {
  126. /** @var string $userIdentifier */
  127. $userIdentifier = (string)$recoverPasswordForm->get('userIdentifier')->getData();
  128. if (empty($userIdentifier)) {
  129. throw new OutputErrorException($translator->trans('portal-engine.auth.user-not-found', [], 'portal_engine_frontend'));
  130. }
  132. $recoverPasswordService->recoverPassword($userIdentifier);
  134. $frontendNotificationService
  135. ->addNotification($translator->trans('portal-engine.auth.password-recover-email', [], 'portal_engine_frontend'), Notification::HTML_CLASS_SUCCESS);
  136. } catch (Exception $e) {
  137. if ($e instanceof OutputErrorException) {
  138. $frontendNotificationService->addNotification($e->getMessage(), Notification::HTML_CLASS_DANGER);
  139. }
  140. }
  141. }
  143. // Same coexistence rule as loginAction(): the studio recover page is served only to
  144. // portals on the new frontend; legacy portals keep the original Bootstrap page. Without
  145. // this the "forgot password" link dropped out of the new design and back into it at the
  146. // /user/data step, which is already migrated.
  147. $template = $frontendVariantService->isNew()
  148. ? '@PimcorePortalEngine/auth/recover_password-studio.html.twig'
  149. : '@PimcorePortalEngine/auth/recover_password.html.twig';
  151. return $this->renderTemplate($template, [
  152. 'recoverPasswordForm' => $recoverPasswordForm->createView(),
  153. 'notification' => $frontendNotificationService->getNotification()
  154. ]);
  155. }
  157. /**
  158. *
  159. * @return RedirectResponse|Response
  160. *
  161. * @throws Exception
  162. */
  163. #[Route(path: '/oidc/endpoint', name: 'pimcore_portalengine_auth_oidc')]
  164. public function oidcAction(Request $request, PortalConfigService $portalConfigService)
  165. {
  166. if (($request->query->get('code') || $request->query->get('error')) && !$request->query->get('redirect')) {
  167. $url = $request->getSchemeAndHttpHost() . $request->getRequestUri() . '&redirect=1';
  169. $content = <<<RESPONSE
  170. <html>
  171. <head>
  172. <meta http-equiv="refresh" content="0;URL=' {$url}'"/>
  173. </head>
  174. <body><p>Redirecting to <a href="{$url}">{$url}</a>.</p></body>
  175. </html>
  176. RESPONSE;
  178. return new Response($content);
  179. }
  181. if (!class_exists('Pimcore\\Bundle\\OpenIdConnectBundle\\PimcoreOpenIdConnectBundle')) {
  182. throw new Exception('OpenID Connect Bundle not available');
  183. }
  185. if ($request->query->get('error')) {
  186. throw new Exception(strip_tags($request->query->getString('error')) . ': ' . strip_tags($request->query->getString('error_description')));
  187. }
  189. $portalConfig = $portalConfigService->getCurrentPortalConfig();
  191. $session = $request->getSession();
  193. /** @var AttributeBag $sessionBag */
  194. $sessionBag = $session->getBag(OpenIdSessionBagListener::SESSION_BAG_NAME);
  196. // if coming back from provider, use provider from session
  197. if ($request->query->get('code')) {
  198. $providerName = $sessionBag->get(OpenIdConnectAuthenticator::SESSION_KEY_PROVIDER);
  199. } else {
  200. $providerName = $request->query->get('provider');
  202. Session::useBag($request->getSession(), function (AttributeBagInterface $sessionBag) use ($providerName) {
  203. $sessionBag->set(OpenIdConnectAuthenticator::SESSION_KEY_PROVIDER, $providerName);
  204. }, OpenIdSessionBagListener::SESSION_BAG_NAME);
  205. }
  207. $oidcConfig = $portalConfig?->getOidcConfig($providerName);
  208. if ($oidcConfig === null) {
  209. throw new InvalidArgumentException(sprintf('Provider `%s` unknown.', strip_tags($request->query->getString('provider'))));
  210. }
  212. $provider = new OpenIdConnectProvider([
  213. 'clientId' => $oidcConfig->getClientId(),
  214. 'clientSecret' => $oidcConfig->getClientSecret(),
  215. 'urlDiscovery' => $oidcConfig->getDiscoveryUrl(),
  216. 'redirectUri' => $request->getSchemeAndHttpHost() . $request->getPathInfo(),
  217. 'scopes' => $oidcConfig->getScopes()
  218. ]);
  219. $provider->setHttpClient($this->httpClient);
  221. if (!$request->query->get('code')) {
  223. // If we don't have an authorization code then get one
  224. $authUrl = $provider->getAuthorizationUrl();
  226. Session::useBag($request->getSession(), function (AttributeBagInterface $sessionBag) use ($provider) {
  227. $sessionBag->set(OpenIdConnectAuthenticator::SESSION_KEY_STATE, $provider->getState());
  228. }, OpenIdSessionBagListener::SESSION_BAG_NAME);
  230. return $this->redirect($authUrl);
  231. } elseif (!$request->query->get('state') || ($request->query->get('state') !== $sessionBag->get('oauth2state'))) {
  232. // Check given state against previously stored one to mitigate CSRF attack
  233. $sessionBag->remove(OpenIdConnectAuthenticator::SESSION_KEY_STATE);
  235. throw new Exception('Invalid state');
  236. }
  238. return $this->redirectToRoute('pimcore_portalengine_auth_login');
  239. }
  240. }